Skip to content

Helm Chart History

Release notes for each Helm chart used by Huddo.

Info

The charts are in our Quay.io registry, with the same access as our images — follow this guide. Log in with helm registry login quay.io before you install or upgrade.

For Component Pack

huddo-cp

Deploys Huddo into an existing HCL Connections Component Pack cluster. Install guide.

Version Description Breaking Changes
2.2.1 First early access release. See What gets deployed and Configuration —
2.3.0 Ingress host set once in global.ingress, a /huddo path prefix, a new environment variable order and fixed socketcluster names. See What changed in 2.3.0 No, but read the notes below
3.0.1 No default S3 keys, ClusterIP Services, Boards prefix stripping and a new worker start-up. See What changed in 3.0.1. Includes 3.0.0 Yes – set the S3 keys first, and use images tagged 2026-10-27 or later. See the warning below
3.1.1 Huddo Links. See What changed in 3.1.1. Includes 3.1.0, whose links Service and ingress do not work: use 3.1.1 Yes – grant readWrite on huddo-links first, and use images tagged 2026-10-30 or later. See the warning below

What changed in 2.3.0

  • Ingress: set the ingress host once in global.ingress.hosts. global.ingress.className and global.ingress.tls are also new. Every service path now has the /huddo prefix by default. A service with no host gets no Ingress. See Ingress.
  • Environment variables: a new environment variable order: a service's own envArray wins over global.envArray, which wins over global.env. The chart defaults move to defaultEnvArray, defaultVolumes and defaultVolumeMounts.
  • Image tags: a <service>.image.tag now replaces global.imageTag. Before, the chart joined the two values.
  • Socketcluster: the socketcluster objects have fixed names (huddo-socketcluster-*), so you can use any release name. The upgrade renames them, so realtime stops for a short time while clients reconnect.
  • NFS: helm uninstall now keeps the S3 and OpenSearch PersistentVolumes.

Before you upgrade to 2.3.0

  • If you set global.env.SOCKET_CLUSTER_HOST to <release>-socketcluster-worker, remove it. The worker Service is now always huddo-socketcluster-worker. The upgrade stops with an error until you remove it.
  • If you set one variable in more than one key, check the environment variable order. Before, global.env won over <service>.envArray and global.envArray.
  • If you set <service>.envArray, volumes or volumeMounts to replace the chart entries, the chart entries now come back next to yours. To remove them, set defaultEnvArray: []. For volumes, set defaultVolumes: [] and defaultVolumeMounts: [] together.
  • If you set global.imageTag and a <service>.image.tag, that service now uses only its image.tag.
  • If your ingress controller is not Traefik, set ingress.traefik.stripPrefix.enabled: false on attachments, discussions, notifications, search, editor and wikishift. These services now create a Traefik Middleware by default. Without the Traefik CRDs, the upgrade fails. On ingress-nginx, the old and the new socketcluster Ingresses also have the same host and path for a short time, and the admission webhook can reject the upgrade. To prevent this, delete the old Ingresses just before you upgrade: kubectl delete ingress -n connections huddo-cp-socketcluster huddo-cp-socketcluster-prefixed.

After you upgrade to 2.3.0

If a Huddo Boards release runs in the same namespace, restart its user, licence and provider pods. These pods read the socketcluster host only when they start. For a Boards release called huddo-boards-cp:

kubectl rollout restart deployment -n connections \
  huddo-boards-cp-user huddo-boards-cp-licence huddo-boards-cp-provider

Shorter values file

Your per-service ingress.hosts, path and traefik.stripPrefix settings still work, and they win over global.ingress. You can remove them and set the host once in global.ingress.hosts.

NFS volumes stay after an uninstall

On NFS, helm uninstall now keeps the huddo-s3 and huddo-opensearch PersistentVolumes with their claims. s3.persistence.retainOnDelete and opensearch.persistence.retainOnDelete control this (default true). To install the release under a different release name or into a different namespace, first delete the kept claims and these PersistentVolumes. If you do not, Helm stops the install. The data stays on the NFS export.

What changed in 3.0.1

  • S3 keys: the chart no longer sets them. global.env.S3_ACCESS_KEY and global.env.S3_SECRET_KEY have no default, and SeaweedFS takes the same keys from global.envArray or global.env. s3.accessKey and s3.secretKey are now empty, and s3.secretKeyRef.name no longer defaults to s3-secret.
  • Boards ingress: boards-core and boards-webfront strip /api-boards and /boards by default (ingress.traefik.stripPrefix.enabled: true).
  • Services: every Service that was NodePort is now ClusterIP. To keep a node port, set <service>.service.type: NodePort, or socketcluster.service.type: NodePort.
  • Workers: attachments-indexer and search-worker start with args: ["indexer"] and args: ["worker"] instead of the path of the worker script. These args need Huddo images tagged 2026-10-27 or later.
  • Ingress annotations: your own traefik.ingress.kubernetes.io/router.middlewares annotation in ingress.annotations is now added after the chart's middlewares, instead of one replacing the other.
  • Image pull secret: the upgrade stops with an error if imageCredentials.username or imageCredentials.password is not a string.
  • Internal CA: the Secret that global.internalCa.pem creates is kept on helm uninstall.
  • Images: amazon/aws-cli (the S3 bucket Job) moves from 2.37.9 to 2.38.1.
  • Restarts: the attachments-indexer and search-worker pods restart. If you set new S3 keys or take them from a Secret, every pod that uses S3 restarts too.

Before you upgrade to 3.0.1

  • If your values file does not set global.env.S3_ACCESS_KEY and global.env.S3_SECRET_KEY, your release uses the keys that the chart set before. These keys were published in the chart. Set the keys in global.env, or take them from a Secret with global.envArray entries of the same names. To keep the same keys, copy them from helm get values huddo-cp --all --namespace connections. New keys also work with your existing files, because SeaweedFS (s3) reads its keys each time it starts, but then every pod that uses S3 restarts. SeaweedFS uses the same keys as the apps; s3.accessKey and s3.secretKey still win if you set them. Without the keys, the upgrade stops with an error and the running release does not change.
  • If you take the SeaweedFS secret key from a Secret with s3.secretKeyRef, set s3.secretKeyRef.name. It no longer defaults to s3-secret. Without a name, SeaweedFS uses S3_SECRET_KEY from global.envArray or global.env, with no error.
  • Use Huddo images tagged 2026-10-27 or later (global.imageTag). attachments-indexer and search-worker now start with a role argument (indexer, worker). Older images do not accept it, so these two pods do not start.
  • If Boards is enabled (products.boards.enabled) and your ingress controller is not Traefik, set ingress.traefik.stripPrefix.enabled: false on boards-core and boards-webfront. Like the /huddo services, these services now create a Traefik Middleware when they have an ingress host. Without the Traefik CRDs, the upgrade fails.
  • If something reaches a Huddo service on a node port, set service.type: NodePort on that service, or socketcluster.service.type: NodePort for the socketcluster broker, state and worker. This includes an ingress controller or load balancer that sends traffic to node ports, for example the AWS Load Balancer Controller in instance mode. Every Service that was NodePort is now ClusterIP, so the upgrade removes its node port, and the upgrade does not detect this. If you set service.nodePort without service.type: NodePort (or LoadBalancer), the upgrade stops with an error.
  • If you set imageCredentials, quote username and password as strings (or use --set-string). An unquoted number now stops the upgrade with an error.

What changed in 3.1.1

  • Links: a new links service, on by default (products.links.enabled). It is served at /huddo/links, with an in-cluster responder at huddo-links-internal:25465 that is never exposed through the ingress. global.env.LINKS_HOST points the other apps at it. See Links.
  • Click key: the chart generates a huddo-links-secrets Secret holding LINKS_CLICK_KEYS on first install and reuses it on every upgrade. It is kept on helm uninstall. See Links click key.
  • Images: quay.io/huddo/links, tagged with global.imageTag.

Before you upgrade to 3.1.1

  • Grant the certificate user readWrite on the huddo-links database. Running the same command again is safe.
  • Use Huddo images tagged 2026-10-30 or later (global.imageTag). Older tags have no links image, so the links pod does not start.
  • If you deploy with helm template or a GitOps tool such as Argo CD or Flux, set linksSecret.create: false and create the click key Secret yourself. Otherwise every render makes a new key.
  • If your ingress controller is not Traefik, set ingress.traefik.stripPrefix.enabled: false on links. Like the other /huddo services, it creates a Traefik Middleware by default. Without the Traefik CRDs, the upgrade fails.
  • Check links.env.LINKS_TRUSTED_PROXY_HOPS (default '1') against the proxies in front of Huddo. See Set LINKS_TRUSTED_PROXY_HOPS to match your proxies.
  • To leave Links out, set products.links.enabled: false and clear global.env.LINKS_HOST. The apps then show plain links instead of preview cards.

Upgrade command

helm registry login quay.io
helm upgrade huddo-cp oci://quay.io/huddo/huddo-cp --version 3.1.1 \
  -i -f ./huddo-cp.yaml --namespace connections

Note

Images are date-tagged, so changing global.imageTag recreates the pods automatically on upgrade. If you deploy a floating tag instead, restart the deployments:

kubectl rollout restart deployment -n connections -l release=huddo-cp

Standalone Kubernetes

huddo

Deploys Huddo into a Kubernetes cluster with an external MongoDB and S3 endpoint. Install guide.

Version Description Breaking Changes
2.3.1 First early access release. See What gets deployed and Configuration —
2.4.0 Ingress host set once in global.ingress, a /huddo path prefix, a new environment variable order and fixed socketcluster names. See What changed in 2.4.0 No, but read the notes below
2.5.1 ClusterIP Services, Boards prefix stripping and a new worker start-up. See What changed in 2.5.1. Includes 2.5.0 Only if you reach a service on a node port, run Boards without the Traefik CRDs, set service.nodePort or an unquoted imageCredentials value, or use images older than 2026-10-27. See the warning below
2.6.1 Huddo Links. See What changed in 2.6.1. Includes 2.6.0, whose links Service and ingress do not work: use 2.6.1 Yes – grant readWrite on huddo-links first, and use images tagged 2026-10-30 or later. See the warning below

What changed in 2.4.0

  • Ingress: set the ingress host once in global.ingress.hosts. global.ingress.className and global.ingress.tls are also new. Every service path now has the /huddo prefix by default. A service with no host gets no Ingress. See Ingress.
  • Environment variables: a new environment variable order: a service's own envArray wins over global.envArray, which wins over global.env.
  • Image tags: a <service>.image.tag now replaces global.imageTag. Before, the chart joined the two values.
  • Socketcluster: the socketcluster objects have fixed names (huddo-socketcluster-*), so you can use any release name.
  • NFS: helm uninstall now keeps the OpenSearch PersistentVolume.

Before you upgrade to 2.4.0

  • If you set global.env.SOCKET_CLUSTER_HOST to <release>-socketcluster-worker, remove it. The worker Service is now always huddo-socketcluster-worker. The upgrade stops with an error until you remove it.
  • If you set one variable in more than one key, check the environment variable order. Before, global.env won over <service>.envArray and global.envArray.
  • If you set global.imageTag and a <service>.image.tag, that service now uses only its image.tag.
  • If your ingress controller is not Traefik, set ingress.traefik.stripPrefix.enabled: false on attachments, discussions, notifications, search, editor and wikishift. These services now create a Traefik Middleware by default. Without the Traefik CRDs, the upgrade fails.

After you upgrade to 2.4.0

A release called huddo keeps the same socketcluster objects. If your release has a different name, the upgrade renames the socketcluster objects to huddo-socketcluster-*. Realtime then stops for a short time while clients reconnect. In this case, if a Huddo Boards release runs in the same namespace, restart its user, licence and provider pods. These pods read the socketcluster host only when they start.

Shorter values file

Your per-service ingress.hosts, path and traefik.stripPrefix settings still work, and they win over global.ingress. You can remove them and set the host once in global.ingress.hosts.

NFS volume stays after an uninstall

On NFS, helm uninstall now keeps the huddo-opensearch PersistentVolume with its claim. opensearch.persistence.retainOnDelete controls this (default true). To install the release under a different release name or into a different namespace, first delete the kept claim and this PersistentVolume. If you do not, Helm stops the install. The data stays on the NFS export.

What changed in 2.5.1

  • Boards ingress: boards-core and boards-webfront strip /api-boards and /boards by default (ingress.traefik.stripPrefix.enabled: true).
  • Services: every Service that was NodePort is now ClusterIP. To keep a node port, set <service>.service.type: NodePort, or socketcluster.service.type: NodePort.
  • Workers: attachments-indexer and search-worker start with args: ["indexer"] and args: ["worker"] instead of the path of the worker script. These args need Huddo images tagged 2026-10-27 or later.
  • Ingress annotations: your own traefik.ingress.kubernetes.io/router.middlewares annotation in ingress.annotations is now added after the chart's middlewares, instead of one replacing the other.
  • Image pull secret: the upgrade stops with an error if imageCredentials.username or imageCredentials.password is not a string.
  • Internal CA: the Secret that global.internalCa.pem creates is kept on helm uninstall.
  • Restarts: the attachments-indexer and search-worker pods restart.

Before you upgrade to 2.5.1

  • Use Huddo images tagged 2026-10-27 or later (global.imageTag). attachments-indexer and search-worker now start with a role argument (indexer, worker). Older images do not accept it, so these two pods do not start.
  • If Boards is enabled (products.boards.enabled) and your ingress controller is not Traefik, set ingress.traefik.stripPrefix.enabled: false on boards-core and boards-webfront. Like the /huddo services, these services now create a Traefik Middleware when they have an ingress host. Without the Traefik CRDs, the upgrade fails.
  • If something reaches a Huddo service on a node port, set service.type: NodePort on that service, or socketcluster.service.type: NodePort for the socketcluster broker, state and worker. This includes an ingress controller or load balancer that sends traffic to node ports, for example the AWS Load Balancer Controller in instance mode. Every Service that was NodePort is now ClusterIP, so the upgrade removes its node port, and the upgrade does not detect this. If you set service.nodePort without service.type: NodePort (or LoadBalancer), the upgrade stops with an error.
  • If you set imageCredentials, quote username and password as strings (or use --set-string). An unquoted number now stops the upgrade with an error.

What changed in 2.6.1

  • Links: a new links service, on by default (products.links.enabled). It is served at /huddo/links, with an in-cluster responder at huddo-links-internal:25465 that is never exposed through the ingress. global.env.LINKS_HOST points the other apps at it. See Links.
  • Click key: the chart generates a huddo-links-secrets Secret holding LINKS_CLICK_KEYS on first install and reuses it on every upgrade. It is kept on helm uninstall. See Links click key.
  • Images: quay.io/huddo/links, tagged with global.imageTag.

Before you upgrade to 2.6.1

  • Grant your MongoDB user readWrite on the huddo-links database.
  • Use Huddo images tagged 2026-10-30 or later (global.imageTag). Older tags have no links image, so the links pod does not start.
  • If you deploy with helm template or a GitOps tool such as Argo CD or Flux, set linksSecret.create: false and create the click key Secret yourself. Otherwise every render makes a new key.
  • If your ingress controller is not Traefik, set ingress.traefik.stripPrefix.enabled: false on links. Like the other /huddo services, it creates a Traefik Middleware by default. Without the Traefik CRDs, the upgrade fails.
  • Check links.env.LINKS_TRUSTED_PROXY_HOPS (default '1') against the proxies in front of Huddo. See Set LINKS_TRUSTED_PROXY_HOPS to match your proxies.
  • To leave Links out, set products.links.enabled: false and clear global.env.LINKS_HOST. The apps then show plain links instead of preview cards.

Upgrade command

helm registry login quay.io
helm upgrade huddo oci://quay.io/huddo/huddo --version 2.6.1 \
  -i -f ./huddo.yaml --namespace huddo